Since the spec requires AC_METADATA_URL env var,
well known IP is no longer needed. This removes
the iptables manipulation. Instead the IP address of the
host is passed in the AC_METADATA_URL. This host IP
is the address of the host end of the default veth.
When using overlay fs rkt status stopped working because it searched for
the status file in the stage1 rootfs, which is either in a different
mount namespace or unmounted.
If the container uses overlay fs, we now search in its upper layer,
which is accessible outside the mount namespace or when the filesystem
is not mounted.
This mounts stage1 and the application images as an overlay filesystem
using each ACI's cached tree as the lower filesystem.
Also, the mounts are done in a separate mount namespace so they will be
unmounted when the container exits and they're not visible by the rest
of the system.
Systems that don't support overlay fall back to plain copying.
By using systemd's Standard{Input,Output,Error} options we set
/dev/console in stage1 as the tty for the app (see systemd.exec(5)).
This makes interactive executables like bash work with rkt run (or
prepare+run-prepared).
This is only supported if the container has only one app.
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
One may now specify an alternative stage1 in a style like run and fetch:
rkt run --stage1-image foo.com/rocket/stage1 app
--stage1-image defaults to "stage1.aci" within the same directory as the rkt
binary. This is discovered at runtime via "/proc/self/exe"; as long as the rkt
executable and stage1.aci share a directory it should "just work" regardless of
the directory's location and where rkt is executed from.
Jonathan Boulle